Password security

[Mike Chambers]

Hey all,

Obviously when installing F22 now, you have that new password security
level to make you jump through hoops to set a password during install.
I understand the reasoning for "secure" passwords, but there is one
catch.

*I* am the admin at my house hold, and *I* am the admin at my company
(scenario speaking), and *I* set how secure I want passwords set at
those locations, not *you*.  I will determine how tough I want my
systems, I don't need any hand holding, nor help.

And in reality, we don't have a lot of kids, grandmas, grandpas,
careless operators, typical window users using these systems as normal
everyday workstations like window users, so they aren't going to
experience the same issues.  

Linux is not like windows, it doesn't have the same type system, so the
same type things won't hurt it.  Most stuff that will get hurt, stolen
from, hacked, whatever is online stuff such as banks, credit cards
stuff, etc..

In other words, give us the tools to help get people in the right
direction, but don't try to turn the wrench as well.  That's up to use
to get it how tight we want.  Whether it falls apart or not, is on us.


Besides that, I changed that crap back to what I wanted in the first
place after the install.  So your security was breached off the bat.
Please get rid of it and set it back to like before.

Thanks and have a good day,


-- 
Mike Chambers
Madisonville, KY

"Best little town on Earth!"

[Scott Robbins]

On Mon, Mar 02, 2015 at 04:16:56PM -0600, Mike Chambers wrote:
>  Hey all,
>  
>  Obviously when installing F22 now, you have that new password security
>  level to make you jump through hoops to set a password during install.
>  I understand the reasoning for "secure" passwords, but there is one
>  catch. 
A ticket was opened with Fesco.  

https://fedorahosted.org/fesco/ticket/1412


>  
>  In other words, give us the tools to help get people in the right
>  direction, but don't try to turn the wrench as well.  That's up to use
>  to get it how tight we want.  Whether it falls apart or not, is on us. 
There has been a great deal of complaint about it, both here, and from the
people who use this stuff for actual work on the CentOS list, but so far,
it seems to have been ignored.

>  
>  Besides that, I changed that crap back to what I wanted in the first
>  place after the install.  So your security was breached off the bat.
>  Please get rid of it and set it back to like before. 
Again, almost everyone has requested that.  
It's being ignored.  


-- 
Scott Robbins
PGP keyID EB3467D6
( 1B48 077D 66F6 9DB0 FDC2 A409 FA54 EB34 67D6 )
gpg --keyserver pgp.mit.edu --recv-keys EB3467D6

[Christopher Meng]

Looks like those Red Hat Security guys want to predefine what security
is exactly for people over the globe, that's some kinda superflous
thing I'm confused.

Please checkout this thread:

https://lists.fedoraproject.org/pipermail/test/2015-February/124965.html

-- 

Yours sincerely,
Christopher Meng

http://cicku.me

[Adam Williamson]

On Tue, 2015-03-03 at 17:39 +0800, Christopher Meng wrote:
>  Looks like those Red Hat Security guys want to predefine what 
>  security is exactly for people over the globe, that's some kinda 
>  superflous thing I'm confused. 
It has nothing at all to do with Red Hat Security, and I'm not sure 
what anyone's accomplishing by rehashing the same points that were 
already made multiple times in the first thread. If they didn't change 
the devs' mind then, I don't think they're going to now. Do we really 
need to waste the bytes?
-- 
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net

[Chris Murphy]

FYI from yesterday's FESCo meeting:

* #1412 anaconda password change is causing consternation among the user
  community please review this policy decision  (ajax, 18:24:10)
  * AGREED: FESCo would like anaconda to turn back on the "double-done"
    option for Fedora 22. Better solutions should be investigated for
    F23.  (ajax, 18:43:33)

So anyone blue can start breathing again, and relax. I expect not to
see a change until beta composes since alpha is in freeze.


Chris Murphy

[Robert Moskowitz]

On 03/02/2015 05:16 PM, Mike Chambers wrote:
>  Hey all,
>
>  Obviously when installing F22 now, you have that new password security
>  level to make you jump through hoops to set a password during install.
>  I understand the reasoning for "secure" passwords, but there is one
>  catch. 
What will happen is that a single (or small subset) of passwords will be 
used for root during install (Fedora_Project works fine, you don't have 
to add the 123 at the end).  User ID setup will be done with admin 
rights and no password required.  Then after install is complete, passwd 
would be used to set up a 'regular' password for root and the user.

Meanwhile the system is on the net with a known root password and maybe 
a knowable user ID for N minutes with SSH up and running and open.  What 
is the exposure.

Besides SSH what other attack vector exists until the passwords are reset?

>  *I* am the admin at my house hold, and *I* am the admin at my company
>  (scenario speaking), and *I* set how secure I want passwords set at
>  those locations, not *you*.  I will determine how tough I want my
>  systems, I don't need any hand holding, nor help.
>
>  And in reality, we don't have a lot of kids, grandmas, grandpas,
>  careless operators, typical window users using these systems as normal
>  everyday workstations like window users, so they aren't going to
>  experience the same issues.
>
>  Linux is not like windows, it doesn't have the same type system, so the
>  same type things won't hurt it.  Most stuff that will get hurt, stolen
>  from, hacked, whatever is online stuff such as banks, credit cards
>  stuff, etc..
>
>  In other words, give us the tools to help get people in the right
>  direction, but don't try to turn the wrench as well.  That's up to use
>  to get it how tight we want.  Whether it falls apart or not, is on us.
>
>
>  Besides that, I changed that crap back to what I wanted in the first
>  place after the install.  So your security was breached off the bat.
>  Please get rid of it and set it back to like before.
>
>  Thanks and have a good day,
>
>

[Gregory Woodbury]

This is just the latest symptom that Fedora and RedHat are showing of
a disease I call "beating Microsoft at their own game."

The main symptom is removing choice and forcing admins and users to do
things the way the company wants you to do it. "Things will LOOK this
way!  Things will WORK that way!"
It is as if someone has decided that Fedora / RedHat will be as simple
to install and use as Windows and will look as much like it as
possible.

If I wanted a locked down (and bug-ridden) OS for my computer I would
just go ahead and use Microsoft.
I choose Linux because I want choice, power and flexibility, and the
advantages that open source supplies.

In either case, a computing mono-culture is not advantageous for
anyone except the corporation(s) controlling that mono-culture.

On Tue, Mar 3, 2015 at 8:14 AM, Robert Moskowitz <rgm(a)htt-consult.com&gt; wrote:
>  On 03/02/2015 05:16 PM, Mike Chambers wrote:
> >
> > Hey all,
> >
> > Obviously when installing F22 now, you have that new password security
> > level to make you jump through hoops to set a password during install.
> > I understand the reasoning for "secure" passwords, but there is one
> > catch.
>
>
>  What will happen is that a single (or small subset) of passwords will be
>  used for root during install (Fedora_Project works fine, you don't have to
>  add the 123 at the end).  User ID setup will be done with admin rights and
>  no password required.  Then after install is complete, passwd would be used
>  to set up a 'regular' password for root and the user.
>
>  Meanwhile the system is on the net with a known root password and maybe a
>  knowable user ID for N minutes with SSH up and running and open.  What is
>  the exposure.
>
>  Besides SSH what other attack vector exists until the passwords are reset?
>
> >
> > *I* am the admin at my house hold, and *I* am the admin at my company
> > (scenario speaking), and *I* set how secure I want passwords set at
> > those locations, not *you*.  I will determine how tough I want my
> > systems, I don't need any hand holding, nor help.
> >
> > And in reality, we don't have a lot of kids, grandmas, grandpas,
> > careless operators, typical window users using these systems as normal
> > everyday workstations like window users, so they aren't going to
> > experience the same issues.
> >
> > Linux is not like windows, it doesn't have the same type system, so the
> > same type things won't hurt it.  Most stuff that will get hurt, stolen
> > from, hacked, whatever is online stuff such as banks, credit cards
> > stuff, etc..
> >
> > In other words, give us the tools to help get people in the right
> > direction, but don't try to turn the wrench as well.  That's up to use
> > to get it how tight we want.  Whether it falls apart or not, is on us.
> >
> >
> > Besides that, I changed that crap back to what I wanted in the first
> > place after the install.  So your security was breached off the bat.
> > Please get rid of it and set it back to like before.
> >
> > Thanks and have a good day,
> >
> >
>
>  --
>  test mailing list
>  test(a)lists.fedoraproject.org
>  To unsubscribe:
>  https://admin.fedoraproject.org/mailman/listinfo/test 


-- 
-- 
G.Wolfe Woodbury
redwolfe(a)gmail.com